DIY Wardriving: Building your Wireless Exploration Arsenal PART 3

Ok! the final part for this wardriving trilogy is already here!

In this final part we will focus on the observability and data rendering part since it’s the most visually attractive and allows us to easily read data and extract some isights.

So here we go! We’re mainly leveraging on Grafana which is an amazing tool for renering data from multiple data sources. If you still don’t know the tool just give it a try you won’t regret.

So once our portable device has captured all the data and saved it into JSON files on the disk. Those files need to be transfered where the database is. It can be the cloud, the local machine or any other device but in this case we thought that it would be better to just send the data so other teams can be already getting insights from that data in real time from another location.Basically the ability to work in parallel while somebody is just walking(scanning) and just gathering data while sunbathing with a mojito. 😎

In order to simplify things we already explained a simple method which is just syncing or copying the data with a simple scp from one device to the other. Either the raspi ( if it has Internet connection) can copy the data to the cloud or directly insert it into the database. That’s up to you.

The thing is once we captured the data and visualize it for the first time there are a couple of things to fix.

FIX 1: All the datapoints overlap in geomap. This happens because there are groups of dozens of datapoints with the same exact GPS coordinates. Every time (every 5 seconds) our script gathers the data from the wireless antena, it associates all those BSSID’s with a specific GPS coordinates ( lattitude and longitude ). Ok great. To solve this we just added a simple funciton to add rome randomness when inserting into the database:

Randomness function to avoid datapoints overlapping on geomap

The randomness is calculated to be aproximately ~20m around, which is approximately 0.000180 degrees. This will provide better render results.

FIX 2: Avoid repeated BSSID inserts in the database.

After a couple of tries we realized that every test with the same sample data set increases the number of BSSID’s in the database. Umhhh some stupid mistake. So we just need to verify before inserting that BSSID that it already exists or not into the database.

Once this is fixed now we can see better data renders and avoid repetitions so now we have clean and rich data already indexed.

Let’s do some SQL queries!

First of all we want all the data to render all thos access points in our map:

SELECT * FROM wireless_networks LIMIT 500;

This will ensure we get all the data (pin points) into the geo map plugin. In this case the top map is showing geomap with a heatmap representation to measure access points density.

Wireless data representation in grafana geomap

On the bottom there are only vulnerable or simply open networks.

More useful queries can be found on the repository:

https://github.com/zpol/wardriver

At this point you’re probably thinking that this is cool but not interesting enough since most of them are private and encrypted networks so how is this information useful or how could maliciously used?

Am I right? Well look it this way.

What if instead of looking for AP’s (Access Points) we also search for all the devices? MAC addresses that are constantly emmiting the usual network they are connected to and its’ own identifier ( smartphones, laptops, cars, watches,IoT,…)

Well with a big enough data set and getting some information in real time with a few more portable devices on strategic locations we can detect and track people. Based on that information you can know for example if that person went to work or not that day. We don’t need so many datapoints to know that. Scary right?

If not scared yet try to read this paper (https://www.cs.umd.edu/~dml/papers/wifi-surveillance-sp24.pdf) about how to massively spy at a Geo-strategic level with the Wi-Fi Positioning Systems (WPS) of your iPhone or your Android.

Longshort story researchers have demonstrated the Geo-Strategic value of these WPS databases, and the impact it can have both for the massive espionage of countries, as well as for intelligence, and how it could be exploited by any nation to prepare an attack or have crucial and sensitive information crucial of targeted objectives.

It will be a workshop in Barcelona hopefuly soon where you will be able to learn how to build from scratch this device and perform some live attacks on AP’s, learn some of the techniques and how they work. We will talk also about the data insights, how to extract them and how powerful is this data that ALL OUR DEVICES are constantly spreading wherever they are.

Stay tuned at: https://www.meetup.com/es-ES/hackingcybersecurity/

See you there! 😎